Security and data

Your credentials

• The identifier, secret and access key are encrypted before they are stored and are never shown again, not even to you. Only the bot and the panel's connection code ever open them.
• They are never written to logs. When WHMCS answers with an error, webticketer keeps one short sentence about it, with any address or credential in the text removed.
• Give the credentials the smallest role that works (see Set up WHMCS), so a leak could not do more than read and answer tickets. If you think a credential has leaked, delete it in WHMCS, make new ones and enter them in the card.

Your customers' data

A WHMCS ticket brought into the panel is stored like a Discord ticket: its subject, the customer's name, and the messages. The customer's email address is not stored. Agents of your server can read it; nobody else can. Messages written in WHMCS are copied, so WHMCS remains the record on that side.

You are responsible for having a reason to process your customers' tickets in this way and for telling them. Nothing done in the panel deletes anything in WHMCS. A customer who is not a Discord member cannot use Delete my data, which works on Discord accounts; to remove their WHMCS tickets from webticketer, ask the webticketer team (there is no button for it yet).

Which addresses can be used

Only https addresses on the public internet. Anything else (http, a name that points inside a private network, an address with a username and password in it, redirects) is refused, so the connection cannot be used to reach other systems.